Release date:
2026-09-01 14:07:05 UTC
Description:
- CVE-2024-6345: replace os.system() shell strings with subprocess argv lists
in PackageIndex VCS downloads, closing a command injection via crafted
git/hg/svn URLs
- CVE-2025-47273: sanitise the download filename derived from a URL so a
percent-encoded absolute path can no longer escape the temporary directory
Updated packages:
-
alt-python27-setuptools-36.3.0-7.el9.noarch.rpm
sha:83bed2b1a4da63f0b89566490f1369e33f3153da895c3cca1ffd0dd828359eeb
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
